Arclight In incubation
Continuous threat exposure management for critical energy infrastructure.
The problem
India’s DISCOMs are rolling out 25 crore smart meters and absorbing rooftop solar, batteries and EVs — devices the grid depends on at peak but neither owns nor controls.
Utilities are putting operational technology on the network and extending the grid to devices they neither own nor control, pushing the attack surface into homes. It is a genuinely new attack surface, and its security has not been worked out.
In October 2020, Mumbai lost power for hours and much of the metropolitan region went dark. Investigators later found a state-sponsored group had been inside the IT networks around India’s power grid. The people downstream were households, hospitals and local trains that had no way to know. That is the tip of the iceberg.
The product
Arclight unifies enterprise IT and the cyber-physical control layer in one context engine, so an exposure in a corporate identity system and an exposure in a field controller are understood as parts of the same path.
Open-source anchored with no vendor lock-in. The data model, the connectors and the detection content are yours to inspect and extend.
Every agent decision is written to an append-only cryptographic ledger, so when automation acts on the control layer, the record of why cannot be altered after the fact.
What continuous means here
Scope
Inventory IT assets, OT devices and the distributed resources the grid now depends on, in one graph.
Discover
Map exposures and the attack paths that connect the enterprise to the control layer.
Prioritise
Rank by consequence to the physical system, not by generic severity score.
Validate
Confirm what is actually reachable and record every automated decision to the ledger.
Built for operators, not vendors
Your data stays yours
Each operator runs in its own confidential computing environment, with data resident in India. Only adversary indicators are shared.
No lock-in
Open-source anchored, so the platform can be audited, extended and, if needed, replaced without losing your history.
Measured against your baseline
Every target is agreed in writing before work begins, and progress is reported against it.
Arclight is in incubation. We are working with early operators now.
If you run energy infrastructure or are standing up distributed energy resources, we would like to hear what you are facing.
Tell us what you are facing
Banks, energy operators and research programs are all welcome.